Privacy policy

Version 2026-09-29

ExRabbit handles photographs of receipts, amounts, and sometimes the names of people you had dinner with. This document states exactly what is collected, why, who processes it, for how long, and what you can demand. It is written to be read, not to be accepted unread.

The publisher’s identity is to be completed before the service opens to the public: legal name, registration number and registered address. Until that block is filled in, this document is not enforceable — and we would rather say so here than let you assume otherwise.

1.Who is responsible for your data

The data controller is the publisher of ExRabbit, reachable at contact@exrabbit.online. Everything below is exercised at that address.

There is no data protection officer: the organisation does not meet the thresholds that require one. Your requests therefore go straight to the publisher.

2.What is collected

Nothing is collected behind your back: it all comes from what you type or photograph, except the last item.

  • Your account: name, email address, role within the organisation, and a password we never see in clear text.
  • Your expenses: merchant, date, amount, currency, exchange rate and its date, category, and the notes you write.
  • Your receipts: the photographs and PDFs you attach. They may carry far more than the amount — an address, a partly masked card number, what was ordered.
  • The names of guests, when the compliance agent asks for them on a business meal and you write them down. That is data about other people: enter only what is necessary.
  • The change log: who changed what, and when, so the record still holds up if it is ever audited.
  • The compliance agent’s traces: the expense examined, the tools it called, the verdict it returned and its source.
  • Server-side technical logs: IP address and request timestamps, kept by our host for security purposes.

3.Why, and on what legal basis

Each use has a basis, and they are not equivalent: what rests on the contract cannot be refused without giving up the service, whereas what rests on consent can be withdrawn at any time.

  • Performance of the contract: keeping your expenses, converting currencies, running the compliance check, producing payment requests. Without this processing there is no service.
  • Legal obligation: retaining receipts, which French regulation requires for ten years.
  • Legitimate interest: platform security, the change log, and abuse prevention (the agent’s usage ceilings).
  • Consent: nothing, for now. There is no marketing, no advertising tracker and no profiling. Should that change, the checkbox will be separate and refusable.

4.Who else processes it, and where

ExRabbit does not run on its own. Here is the complete list of subprocessors, what each one receives — and the country, because that is the question that matters for a transfer.

  • Supabase: hosting for the database, authentication and receipts. The data sits in the London region, United Kingdom, covered by a European Commission adequacy decision.
  • OpenAI, United States: reads your receipts to extract merchant, date and amount, and runs the compliance agent. The receipt image and the details of the expense under examination are therefore sent to them. For its programming interface, OpenAI undertakes not to use that content to train its models. The transfer outside the European Union relies on standard contractual clauses.
  • The web application’s host: serves the pages and keeps technical logs. No expense passes through it other than encrypted on its way to your browser.

5.What we do not do

We do not sell or rent your data, to anyone, in any form, including in aggregate. We do not use it to train a model. We do not run advertising and we install no trackers.

The only cookies set are those that keep your session open. They are necessary for the service to work: refusing them amounts to being unable to sign in, which is why no banner asks for your opinion.

6.For how long

Your expenses and receipts are kept for as long as your account exists, and at least ten years for receipts, because the law requires it. That period protects you as much as it binds us: it is exactly how long an audit can ask you for them.

The change log follows the same period as the expenses it documents. The agent’s traces are kept for two years. The host’s technical logs, a few weeks.

When you delete your account, the data is erased, except what legal retention requires us to keep — and in that case it serves no other purpose.

7.Your rights, and how to exercise them

You may request access to your data, its rectification or erasure, restriction of its processing, and you may object to processing based on legitimate interest. Write to contact@exrabbit.online: we answer within one month.

Portability does not need us: under Settings, “Export my data” hands you every expense as a CSV file, frozen exchange rates included, immediately and without asking anyone.

If our answer does not satisfy you, you may lodge a complaint with the French CNIL — www.cnil.fr — or with the data protection authority of the country you live in.

8.Security, and its limits

Separation between organisations is enforced in the database, not merely in the application code: one organisation cannot read another’s rows, including in photo storage. Receipts live in a private space, reachable only through a signed link valid for one hour.

What we cannot promise: no certified evidential archiving, and no end-to-end encryption that would technically prevent us from reading your receipts — automatic extraction and the compliance check both require being able to read them.

9.Changes to this document

Every version carries a date. When the substance changes, the new version is shown to you at sign-in, and your acceptance is recorded with its date and number — which is what makes it possible to know which text you said yes to.

Earlier versions remain in the product’s public source history.